From 27d41ccbb5233a632b4ba62681980efbdf96de00 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thibault=20Delavall=C3=A9e?= <tde@odoo.com>
Date: Fri, 24 Feb 2017 12:45:21 +0100
Subject: [PATCH] [REF] resource: update security rules

Add some rules to enable the read of calendar records by employees as
those rules should not be defined a bit everywhere in various addons.
---
 addons/resource/security/ir.model.access.csv  |  8 +++++---
 .../resource/security/resource_security.xml   | 19 +++++++++++++------
 2 files changed, 18 insertions(+), 9 deletions(-)

diff --git a/addons/resource/security/ir.model.access.csv b/addons/resource/security/ir.model.access.csv
index 6112565d9bf..34ca64a5e94 100644
--- a/addons/resource/security/ir.model.access.csv
+++ b/addons/resource/security/ir.model.access.csv
@@ -1,7 +1,9 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
-access_resource_calendar,resource.calendar,model_resource_calendar,base.group_system,1,1,1,1
-access_resource_calendar_attendance,resource.calendar.attendance,model_resource_calendar_attendance,base.group_system,1,1,1,1
+access_resource_calendar_user,resource.calendar.user,model_resource_calendar,base.group_user,1,0,0,0
+access_resource_calendar_system,resource.calendar.system,model_resource_calendar,base.group_system,1,1,1,1
+access_resource_calendar_attendance_user,resource.calendar.attendance.user,model_resource_calendar_attendance,base.group_user,1,0,0,0
+access_resource_calendar_attendance_system,resource.calendar.attendance.system,model_resource_calendar_attendance,base.group_system,1,1,1,1
 access_resource_resource,resource.resource,model_resource_resource,base.group_system,1,0,0,0
 access_resource_resource_all,resource.resource all,model_resource_resource,base.group_user,1,0,0,0
-access_resource_calendar_leaves_user,resource.calendar.leaves,model_resource_calendar_leaves,base.group_user,1,0,0,0
+access_resource_calendar_leaves_user,resource.calendar.leaves,model_resource_calendar_leaves,base.group_user,1,1,1,1
 access_resource_calendar_leaves,resource.calendar.leaves,model_resource_calendar_leaves,base.group_system,1,1,1,1
diff --git a/addons/resource/security/resource_security.xml b/addons/resource/security/resource_security.xml
index d33fdebc296..e26ed21379a 100644
--- a/addons/resource/security/resource_security.xml
+++ b/addons/resource/security/resource_security.xml
@@ -2,15 +2,22 @@
 <odoo>
 <data noupdate="1">
 
-    <record model="ir.rule" id="resource_own_leaves">
-        <field name="name">Resource: see own leaves</field>
+    <record model="ir.rule" id="resource_calendar_leaves_rule_group_user_create">
+        <field name="name">resource.calendar.leaves: employee reads own or global</field>
         <field name="model_id" ref="model_resource_calendar_leaves"/>
         <field name="groups" eval="[(4, ref('base.group_user'))]"/>
-        <field name="domain_force">['|',
-                                        ('resource_id', '=', False),
-                                        ('resource_id.user_id', '=', user.id),
-                                    ]</field>
+        <field name="domain_force">['|', ('resource_id', '=', False), ('resource_id.user_id', '=', user.id)]</field>
+		<field name="perm_write" eval="False"/>
+		<field name="perm_create" eval="False"/>
+		<field name="perm_unlink" eval="False"/>
     </record>
 
+    <record model="ir.rule" id="resource_calendar_leaves_rule_group_user_modify">
+        <field name="name">resource.calendar.leaves: employee modifies own</field>
+        <field name="model_id" ref="model_resource_calendar_leaves"/>
+        <field name="groups" eval="[(4, ref('base.group_user'))]"/>
+        <field name="domain_force">[('resource_id.user_id', '=', user.id)]</field>
+		<field name="perm_read" eval="False"/>
+    </record>
 </data>
 </odoo>